notepad++.exe

Top Paths

• C:\Program Files (x86)\Notepad++58.07%
• C:\Program Files\Notepad++40.62%
• C:\...1.29%
• C:\Users\...0.02%

Top Hashes (SHA256)

• 02f2cee4118a8f8d732d736e1758a38abdceea6470ba63ea224ae56b27e4983c7.65%
• eecb0830e714c5eecbb92093f34695c5780629c9e868a988bb55b28a6fec12827.3%
• cf45dc3efb09309f4a2f7275a8d011a0d0cf65b3dd69a867a708a78a1076bbb76.39%
• cfe60c8f1ee2e24e85c0db158389661c607cd6e2ed4aa65513d677afae44c43a6.27%
• 2b50feddac0e4ad2fc3fe8626f717027116db782fc7826392cbd0e1951850fde6.06%
• 44e3b542da9d6684561deb186752fd13caa0f05099ac43d5cc5f72f6229801615.36%
• bef8e0c7ec65242c0555967501fd2f76bc1179af25c207d16ad6bd70719941ba5.21%
• a559ec6a8b7951551b1e10943326a9a7c585181acf91cf4ef267b2bde9b8173c4.86%
• ee99040d5f1ec24b3cfe073c1aec5a27517880213dd8fde7d79f73ff1b9a7d314.86%
• afdf7e9308c8023504addd81afda146ca0b7549d8b6cf4662506c3d7d4d2b9da3.77%
• c5c20737cab116cb5f40a124cbe48eee03e1cc83fc3cda13dfcc0bfad3aa796c

Top Grandparents

• userinit.exe85.55%
• svchost.exe5.12%
• explorer.exe4.92%
• winlogon.exe1.27%
• GUP.exe1.03%
• notepad++.exe0.52%
• chrome.exe0.48%
• powershell.exe0.24%
• WerFault.exe0.2%
• googledrivesync.exe0.16%

Top Parents

• explorer.exe92.25%
• cmd.exe2.01%
• OpenWith.exe1.43%
• notepad++.exe0.69%
• chrome.exe0.31%
• dllhost.exe0.31%
• OUTLOOK.EXE0.26%
• RuntimeBroker.exe0.26%
• firefox.exe0.14%
• 7zFM.exe0.07%

Top Children

• GUP.exe84.16%
• chrome.exe5.13%
• notepad++.exe4.25%
• splwow64.exe1.32%
• OUTLOOK.EXE0.59%
• firefox.exe0.44%
• crashpad_handler.exe0.29%
• WerFault.exe0.29%
• iexplore.exe0.15%
• msedge.exe0.15%

What does notepad++.exe normally do?

Notepad++ is a general-purpose text/source-code editor; on a developer or admin workstation it is routinely launched interactively from Explorer, a shell, or via its shell context-menu entry, and opens files with switches such as -multiInst and -nosession. In the lab the winget-sourced installer (npp.8.9.8.Installer.x64.exe, signed "NOTEPAD++") ran silently with /S from PowerShell, wrote the application tree under C:\Program Files\Notepad++ (autoCompletion XMLs, contextMenu\NppShell.dll), registered shell/CLSID keys including HKCR\*\shell\ANotepad++64, and invoked signed Microsoft PowerShell once to Add-AppxPackage the bundled contextMenu\NppShell.msix. Runtime activity consisted of notepad++.exe (signed, from Program Files) spawning its bundled updater C:\Program Files\Notepad++\updater\GUP.exe with a fixed argument set (-infoUrl=https://notepad-plus-plus.org/update/getDownloadUrl.php -forceDomain=https://github.com/notepad-plus-plus/... -chkCert4InfoXML -chkCertKeyId4XML=CC0D94922CDA3A18A7D286138525AF9C3942E9E7); GUP.exe reached notepad-plus-plus.org/github.com over 443/80, made a loopback connection, and in one instance crashed into WerFault.exe. All other network noise (msedgewebview2, svchost, backgroundtaskhost, OneDrive updater, MSN/Microsoft telemetry endpoints) was unrelated Windows 11 background traffic.

When is notepad++.exe suspicious?

notepad++.exe or GUP.exe running from outside C:\Program Files\Notepad++ (e.g. %APPDATA%, %TEMP%, %PUBLIC%, ProgramData, a user Downloads folder) or with a broken/absent Authenticode signature; GUP.exe launched with a parent other than notepad++.exe, or with -infoUrl/-forceDomain values pointing at non-notepad-plus-plus.org / non-github.com hosts, or with certificate-checking switches (-chkCert4InfoXML, -chkCertSig, -chkCertRevoc) removed. Unsigned or recently written DLLs inside the install tree or plugins\ subfolders (SciLexer.dll, libcurl.dll, NppShell.dll, plugins\*\*.dll) that are not part of the shipped package, and modifications to updater\gup.xml changing the update URL. notepad++.exe spawning cmd.exe, powershell.exe, wscript/cscript, rundll32 or curl (typical of NppExec/plugin-driven command execution) or making outbound connections to non-Notepad++ infrastructure. Installer-like activity that does not match the baseline: an "npp*Installer*.exe" that is unsigned or signed by an unexpected CA, run from a browser download path with an unusual parent (Outlook, WinRAR, mshta), or Notepad++ binaries appearing on a server with no interactive editing use case.

How do attackers abuse notepad++.exe?

Notepad++ has a substantial abuse history as a trusted, signed, widely-allowlisted application. (1) Trojanized/fake installers: malvertising and SEO campaigns repeatedly serve counterfeit Notepad++ installers that drop loaders (e.g. WikiLoader, Cobalt Strike beacons, infostealers), and the StrongPity/Promethium actor distributed a tampered Notepad++ installer that side-loaded malicious DLLs. (2) DLL side-loading and hijack of the bundled updater: attackers place a malicious DLL next to the signed GUP.exe or notepad++.exe (libcurl.dll, SciLexer.dll, DLL-proxying wrappers) so a legitimately signed process loads attacker code; GUP.exe is also abused as a signed downloader by rewriting updater\gup.xml or supplying attacker -infoUrl/-forceDomain values so it fetches a remote XML and payload over HTTPS, giving ingress tool transfer with trusted-binary cover. (3) Plugin abuse for execution and persistence: writing a rogue plugin DLL into plugins\<name>\<name>.dll causes it to auto-load whenever the editor starts, and legitimate plugins such as NppExec are used to run arbitrary shell commands, scripts and PowerShell from inside the editor, bypassing naive parent-process and application-control expectations. (4) Masquerading: malware copies itself as notepad++.exe / gup.exe in user-writable paths, or uses the Notepad++ icon and version strings to look benign in process lists. (5) Post-exploitation use of the editor itself: attackers use it to read and edit credential-bearing files, scripts and web content, and Notepad++ backup/session artifacts (backup\, session.xml, cloud settings) are collected because they often contain fragments of sensitive files or credentials.

Detection guidance

Baseline the exact GUP.exe command line seen here and alert on any deviation: parent != notepad++.exe, image path outside C:\Program Files\Notepad++\updater, altered -infoUrl/-forceDomain, or missing -chkCert* switches; likewise alert on file modifications to updater\gup.xml. Monitor image-load events for unsigned or non-Notepad++-signed DLLs loaded by notepad++.exe or GUP.exe, and file-create events for new DLLs in the install directory or plugins\ tree outside a legitimate installer/updater window. Treat notepad++.exe as a suspicious parent: any child cmd.exe, powershell.exe, mshta, wscript, curl or rundll32 is worth investigation (NppExec or injected code), as is notepad++.exe making network connections to hosts other than notepad-plus-plus.org/github.com/githubusercontent.com. Hunt for name-masquerading by matching on process name notepad++.exe/gup.exe with an unexpected path, missing signature, or signer other than "NOTEPAD++", and validate installer provenance (signed by NOTEPAD++, expected hash) before allowing silent /S installs from PowerShell or other scripted parents.

MITRE ATT&CK techniques

References

• https://notepad-plus-plus.org/
• https://notepad-plus-plus.org/